Lines Matching refs:label
5 * This file contains AppArmor label definitions
16 #include "include/label.h"
27 * code - will take a ref count on a label if it needs the label
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
34 * Labels are not ref counted by the label set, so they maybe removed and
45 /* p->label will not updated any more as p is dead */
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
60 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
67 rcu_assign_pointer(new->label, aa_get_label(label));
81 tmp = rcu_dereference_protected(orig->proxy->label,
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
99 * ns_cmp - compare ns for label set ordering
156 * vec_cmp - label comparison for set ordering
157 * @a: label to compare (NOT NULL)
208 u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
210 if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
315 void aa_label_destroy(struct aa_label *label)
317 AA_BUG(!label);
319 if (!label_isprofile(label)) {
323 aa_put_str(label->hname);
325 label_for_each(i, label, profile) {
327 label->vec[i.i] = (struct aa_profile *)
332 if (label->proxy) {
333 if (rcu_dereference_protected(label->proxy->label, true) == label)
334 rcu_assign_pointer(label->proxy->label, NULL);
335 aa_put_proxy(label->proxy);
337 aa_free_secid(label->secid);
339 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
342 void aa_label_free(struct aa_label *label)
344 if (!label)
347 aa_label_destroy(label);
348 kfree(label);
351 static void label_free_switch(struct aa_label *label)
353 if (label->flags & FLAG_NS_COUNT)
354 aa_free_ns(labels_ns(label));
355 else if (label_isprofile(label))
356 aa_free_profile(labels_profile(label));
358 aa_label_free(label);
363 struct aa_label *label = container_of(head, struct aa_label, rcu);
365 if (label->flags & FLAG_IN_TREE)
366 (void) aa_label_remove(label);
367 label_free_switch(label);
372 struct aa_label *label = container_of(kref, struct aa_label, count);
373 struct aa_ns *ns = labels_ns(label);
377 label_free_switch(label);
381 AA_BUG(label_isprofile(label) &&
382 on_list_rcu(&label->vec[0]->base.profiles));
383 AA_BUG(label_isprofile(label) &&
384 on_list_rcu(&label->vec[0]->base.list));
386 /* TODO: if compound label and not stale add to reclaim cache */
387 call_rcu(&label->rcu, label_free_rcu);
390 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
392 if (label != new)
399 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
401 AA_BUG(!label);
404 if (aa_alloc_secid(label, gfp) < 0)
407 label->size = size; /* doesn't include null */
408 label->vec[size] = NULL; /* null terminate */
409 kref_init(&label->count);
410 RB_CLEAR_NODE(&label->node);
416 * aa_label_alloc - allocate a label with a profile vector of @size length
417 * @size: size of profile vector in the label
421 * Returns: new label
458 * label_cmp - label comparison for set ordering
459 * @a: label to compare (NOT NULL)
460 * @b: label to compare (NOT NULL)
477 int aa_label_next_confined(struct aa_label *label, int i)
479 AA_BUG(!label);
482 for (; i < label->size; i++) {
483 if (!profile_unconfined(label->vec[i]))
492 * @I: label iterator
493 * @set: label to test against
494 * @sub: label to if is subset of @set
531 * @set: label to test against
532 * @sub: label to test if is subset of @set
552 * @set: label to test against
553 * @sub: label to test if is subset of @set
586 * __label_remove - remove @label from the label set
587 * @l: label to remove
588 * @new: label to redirect to
590 * Requires: labels_set(@label)->lock write_lock
591 * Returns: true if the label was in the tree and removed
593 static bool __label_remove(struct aa_label *label, struct aa_label *new)
595 struct aa_labelset *ls = labels_set(label);
598 AA_BUG(!label);
602 __aa_proxy_redirect(label, new);
604 if (!label_is_stale(label))
605 __label_make_stale(label);
607 if (label->flags & FLAG_IN_TREE) {
608 rb_erase(&label->node, &ls->root);
609 label->flags &= ~FLAG_IN_TREE;
617 * __label_replace - replace @old with @new in label set
618 * @old: label to remove from label set
619 * @new: label to replace @old with
625 * Note: current implementation requires label set be order in such a way
627 * using pointer comparison of the label address would not work)
653 * __label_insert - attempt to insert @l into a label set
655 * @label: new label to insert (NOT NULL)
662 * else ref counted equivalent label that is already in the set,
666 struct aa_label *label, bool replace)
671 AA_BUG(!label);
672 AA_BUG(labels_set(label) != ls);
674 AA_BUG(label->flags & FLAG_IN_TREE);
680 int result = label_cmp(label, this);
685 * so replace in place, however the label has
693 __proxy_share(this, label);
694 AA_BUG(!__label_replace(this, label));
695 return aa_get_label(label);
703 rb_link_node(&label->node, parent, new);
704 rb_insert_color(&label->node, &ls->root);
705 label->flags |= FLAG_IN_TREE;
707 return aa_get_label(label);
711 * __vec_find - find label that matches @vec in label set
712 * @vec: vec of profiles to find matching label for (NOT NULL)
718 * Returns: ref counted @label if matching label is in tree
719 * ref counted label that is equiv to @l in tree
747 * __label_find - find label @label in label set
748 * @label: label to find (NOT NULL)
750 * Requires: labels_set(@label)->lock held
753 * Returns: ref counted @label if @label is in tree OR
754 * ref counted label that is equiv to @label in tree
755 * else NULL if @label or equiv is not in tree
757 static struct aa_label *__label_find(struct aa_label *label)
759 AA_BUG(!label);
761 return __vec_find(label->vec, label->size);
766 * aa_label_remove - remove a label from the labelset
767 * @label: label to remove
769 * Returns: true if @label was removed from the tree
770 * else @label was not in tree so it could not be removed
772 bool aa_label_remove(struct aa_label *label)
774 struct aa_labelset *ls = labels_set(label);
781 res = __label_remove(label, ns_unconfined(labels_ns(label)));
788 * aa_label_replace - replace a label @old with a new version @new
789 * @old: label to replace
790 * @new: label replacing @old
829 * vec_find - find label @l in label set
830 * @vec: array of profiles to find equiv label for (NOT NULL)
833 * Returns: refcounted label if @vec equiv is in tree
839 struct aa_label *label;
848 label = __vec_find(vec, n);
851 return label;
858 struct aa_label *label = NULL;
867 return aa_get_label(&vec[0]->label);
869 ls = labels_set(&vec[len - 1]->label);
872 * check if label exists before taking locks
882 label = __label_insert(ls, new, false);
884 label_free_or_put_new(label, new);
886 return label;
892 struct aa_label *label = vec_find(vec, len);
894 if (label)
895 return label;
901 * aa_label_find - find label @label in label set
902 * @label: label to find (NOT NULL)
906 * Returns: refcounted @label if @label is in tree
907 * refcounted label that is equiv to @label in tree
908 * else NULL if @label or equiv is not in tree
910 struct aa_label *aa_label_find(struct aa_label *label)
912 AA_BUG(!label);
914 return vec_find(label->vec, label->size);
919 * aa_label_insert - insert label @label into @ls or return existing label
920 * @ls - labelset to insert @label into
921 * @label - label to insert
923 * Requires: caller to hold a valid ref on @label
925 * Returns: ref counted @label if successful in inserting @label
926 * else ref counted equivalent label that is already in the set
928 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
934 AA_BUG(!label);
936 /* check if label exists before taking lock */
937 if (!label_is_stale(label)) {
939 l = __label_find(label);
946 l = __label_insert(ls, label, false);
955 * @I: label iterator
956 * @a: label to merge
957 * @b: label to merge
995 * @a: label to merge then compare (NOT NULL)
996 * @b: label to merge then compare (NOT NULL)
997 * @z: label to compare merge against (NOT NULL)
1033 * label_merge_insert - create a new label by merging @a and @b
1034 * @new: preallocated label to merge into (NOT NULL)
1035 * @a: label to merge with @b (NOT NULL)
1036 * @b: label to merge with @a (NOT NULL)
1040 * Returns: ref counted label either @new if merge is unique
1053 struct aa_label *label;
1072 AA_BUG(!new->vec[k]->label.proxy);
1073 AA_BUG(!new->vec[k]->label.proxy->label);
1074 if (next->label.proxy != new->vec[k]->label.proxy)
1090 label = aa_get_label(&new->vec[0]->label);
1091 return label;
1106 label = __label_insert(labels_set(new), new, false);
1109 return label;
1113 * labelset_of_merge - find which labelset a merged label should be inserted
1114 * @a: label to merge and insert
1115 * @b: label to merge and insert
1117 * Returns: labelset that the merged label should be inserted into
1131 * __label_find_merge - find label that is equiv to merge of @a and @b
1133 * @a: label to merge with @b (NOT NULL)
1134 * @b: label to merge with @a (NOT NULL)
1138 * Returns: ref counted label that is equiv to merge of @a and @b
1173 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1174 * @a: label to merge with @b (NOT NULL)
1175 * @b: label to merge with @a (NOT NULL)
1179 * Returns: ref counted label that is equiv to merge of @a and @b
1185 struct aa_label *label, *ar = NULL, *br = NULL;
1197 label = __label_find_merge(ls, a, b);
1202 return label;
1206 * aa_label_merge - attempt to insert new merged label of @a and @b
1207 * @ls: set of labels to insert label into (NOT NULL)
1208 * @a: label to merge with @b (NOT NULL)
1209 * @b: label to merge with @a (NOT NULL)
1215 * Returns: ref counted new label if successful in inserting merge of a & b
1216 * else ref counted equivalent label that is already in the set.
1217 * else NULL if could not create label (-ENOMEM)
1222 struct aa_label *label = NULL;
1231 * check if label exists before taking locks
1233 label = aa_label_find_merge(a, b);
1236 if (!label) {
1249 label = label_merge_insert(new, a, b);
1250 label_free_or_put_new(label, new);
1256 return label;
1283 * label_compound_match - find perms for full compound label
1285 * @label: label to check access permissions for
1293 * For the label A//&B//&C this does the perm match for A//&B//&C
1299 struct aa_label *label,
1307 label_for_each(i, label, tp) {
1321 label_for_each_cont(i, label, tp) {
1342 * label_components_match - find perms for all subcomponents of a label
1345 * @label: label to check access permissions for
1353 * For the label A//&B//&C this does the perm match for each of A and B and C
1359 struct aa_label *label, aa_state_t start,
1369 label_for_each(i, label, tp) {
1385 label_for_each_cont(i, label, tp) {
1407 * aa_label_match - do a multi-component label match
1410 * @label: label to match (NOT NULL)
1419 struct aa_label *label, aa_state_t state, bool subns,
1422 int error = label_compound_match(profile, rules, label, state, subns,
1428 return label_components_match(profile, rules, label, state, subns,
1434 * aa_update_label_name - update a label to have a stored name
1436 * @label: label to update (NOT NULL)
1439 * Requires: labels_set(label) not locked in caller
1441 * note: only updates the label name if it does not have a name already
1444 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1452 AA_BUG(!label);
1454 if (label->hname || labels_ns(label) != ns)
1457 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
1460 ls = labels_set(label);
1462 if (!label->hname && label->flags & FLAG_IN_TREE) {
1463 label->hname = name;
1473 * cached label name is present and visible
1474 * @label->hname only exists if label is namespace hierachical
1476 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1479 if (label->hname && (!ns || labels_ns(label) == ns) &&
1553 static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1560 label_for_each(i, label, profile) {
1585 /* if any visible label is not unconfined the display_mode returns true */
1586 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1593 label_for_each(i, label, profile) {
1607 * aa_label_snxprint - print a label name to a string buffer
1611 * @label: label to view (NOT NULL)
1620 * label is not visible it will just be excluded. And if none
1621 * of the label is visible "---" will be used.
1624 struct aa_label *label, int flags)
1633 AA_BUG(!label);
1640 ns = labels_ns(label);
1643 label_for_each(i, label, profile) {
1666 if (display_mode(ns, label, flags)) {
1668 label_modename(ns, label, flags));
1677 * aa_label_asxprint - allocate a string buffer and print label into it
1678 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1680 * @label: label to view (NOT NULL)
1681 * @flags: flags controlling what label info is printed
1687 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1693 AA_BUG(!label);
1695 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1702 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1706 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1709 * @label: label to view (NOT NULL)
1710 * @flags: flags controlling what label info is printed
1717 struct aa_label *label, int flags, gfp_t gfp)
1722 AA_BUG(!label);
1724 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1731 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1736 struct aa_label *label, int flags, gfp_t gfp)
1743 AA_BUG(!label);
1745 if (!use_label_hname(ns, label, flags) ||
1746 display_mode(ns, label, flags)) {
1747 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1749 AA_DEBUG("label print error");
1754 str = (char *) label->hname;
1766 struct aa_label *label, int flags, gfp_t gfp)
1769 AA_BUG(!label);
1771 if (!use_label_hname(ns, label, flags)) {
1775 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1777 AA_DEBUG("label print error");
1782 } else if (display_mode(ns, label, flags))
1783 seq_printf(f, "%s (%s)", label->hname,
1784 label_modename(ns, label, flags));
1786 seq_puts(f, label->hname);
1789 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1792 AA_BUG(!label);
1794 if (!use_label_hname(ns, label, flags)) {
1798 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1800 AA_DEBUG("label print error");
1805 } else if (display_mode(ns, label, flags))
1806 pr_info("%s (%s)", label->hname,
1807 label_modename(ns, label, flags));
1809 pr_info("%s", label->hname);
1812 void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1816 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1820 void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1824 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1828 void aa_label_printk(struct aa_label *label, gfp_t gfp)
1832 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1874 * aa_label_strn_parse - parse, validate and convert a text string to a label
1875 * @base: base label to use for lookups (NOT NULL)
1882 * Returns: the matching refcounted label if present
1890 struct aa_label *label, *currbase = base;
1900 base != &root_ns->unconfined->label))
1929 currbase = &vec[i]->label;
1941 return &vec[0]->label;
1946 label = aa_get_label(&vec[0]->label);
1951 label = aa_vec_find_or_create_label(vec, len, gfp);
1953 label = vec_find(vec, len);
1954 if (!label)
1960 return label;
1963 label = ERR_PTR(-ENOENT);
1975 * aa_labelset_destroy - remove all labels from the label set
1976 * @ls: label set to cleanup (NOT NULL)
2014 struct aa_label *label;
2023 label = rb_entry(node, struct aa_label, node);
2024 if ((label_is_stale(label) ||
2025 vec_is_stale(label->vec, label->size)) &&
2026 __aa_get_label(label))
2030 label = NULL;
2035 return label;
2039 * __label_update - insert updated version of @label into labelset
2040 * @label - the label to update/replace
2042 * Returns: new label that is up to date
2047 * Note: worst case is the stale @label does not get updated and has
2050 static struct aa_label *__label_update(struct aa_label *label)
2057 AA_BUG(!label);
2058 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2060 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2066 * and label updates, label merging and removal can be occurring
2068 ls = labels_set(label);
2070 for (i = 0; i < label->size; i++) {
2071 AA_BUG(!label->vec[i]);
2072 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2074 AA_BUG(!new->vec[i]->label.proxy);
2075 AA_BUG(!new->vec[i]->label.proxy->label);
2076 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2080 /* updated stale label by being removed/renamed from labelset */
2086 tmp = aa_get_label(&new->vec[0]->label);
2087 AA_BUG(tmp == label);
2090 if (labels_set(label) != labels_set(new)) {
2097 AA_BUG(labels_ns(label) != labels_ns(new));
2099 tmp = __label_insert(labels_set(label), new, true);
2101 /* ensure label is removed, and redirected correctly */
2102 __label_remove(label, tmp);
2116 * Any label that has a stale component is marked stale and replaced and
2124 struct aa_label *label;
2130 label = labelset_next_stale(&ns->labels);
2131 if (label) {
2132 struct aa_label *l = __label_update(label);
2135 aa_put_label(label);
2137 } while (label);